How can define access rights or visibility based on IPTC/XMP tags previously embedded on JPEG files ?

For example, if a new image provided to ZP is tagged as "private", set it visible only to the administrator. Or a file tagged as "confidential" will be visible only to users of group "A". Or, even further, only JPEGs taken with specific camera model will be accessible to user "B".

I'd like to be able to define these rules but couldn't find any module that let me do that.

I don't care about doing it directly on the DB (I can script that) but would like to have some advise or pointers on how to do that.

Thanks in advance

You have to do this on the theme directly as tags have no relation to our user rights management. Each theme item object has a class method to check for a tag:
http://www.zenphoto.org/documentation/classes/ThemeObject.html#methodhasTag

Then you could use this one to set the image unpublished:
http://www.zenphoto.org/documentation/classes/ThemeObject.html#methodsetShow

Note that this will most likely confuse your thumbnail pagination. So best you do check for this before actually displaying content on your theme.

These methods won't do exactly what I was thinking about. In my idea, single photo visibility or access permission (not just entire albums) should be calculated for each user visiting the site and not globally set the way setShow() does.

Please confirm: apparently ZP user+group system controls only general access rights of the system as "can post comments" etc. You can assign this profile to root-level albums only, not to their sub-albums, not to single photos inside of them.

Zenphoto does not refine access rights to the image level, only the album level. For more details, please refer to the documentation on the Zenphoto site.